Incomplete CSV export

Graylog Central (peer support)
1

1. Describe your incident:
Exporting to CSV produces a CSV file with lots of missing events :

After having typed a very simple query, with time borders, I get a hundred lines of answer, which I’d like to export as CSV, but when clicking on “export to CSV” and setting no limit, I’m witnessing that the resulting csv file does contain way less lines than what was displayed in the web GUI.
Especially, there seem to be a “hole” in the period of time, before and after which the following events do get exported.

2. Describe your environment:

  • OS Information: Debian 10

  • Package Version: graylog-server 4.0.11-1

3. What steps have you already taken to try and solve the problem?
I tried to have a look at server.log to no avail.
I also payed attention about the fact that the exported data are not time-sorted, so I manually sorted them out and yet I confirm the lack of some events.

4. How can the community help?
The only related issues I found about csv exports were complete failure, which is not the case here, as part of the data get exported. So are there other places I could check?

Thank you

Nicolas

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hello @neca

By chance is this a enterprise version?

3

Hello @gsmith ,

No, it’s not an enterprise version.

4

Hello,

What have you tired so far in resolving this issue?

I executed a test for Exporting All search results in within 5 minutes and received all messages for that five minutes. Only thing I can think of is depending what fields you want , perhaps some messages do not have those fields. there for you don’t get all the messages needed.

5

Hello,

The thing is… that I do see them in the web gui before trying to export them, so they do exist.

6

Can you show how your exporting the messages?

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.